- NANOG - lists.nanog.org

Any Megapath / GTT clue?
by mike.lyon＠gmail.com 06 Dec '17

06 Dec '17

Getting no where with the front end support @ Megapath. /28 suddenly is no longer being routed to my client. Any help would be appreciated. Thank You, Mike

2 1

Equinix SV8 Facebook IPv6 router 2001:504:D::47/64 constantly bouncing sessions
by Peter Kranz 06 Dec '17

06 Dec '17

Are other SV8 peering exchange participants seeing problems with Facebooks 2001:504:D::47/64 router in the SV8? Been seeing this for over 48 hours now. No issues with other SV8 peers, or Facebooks other IPv6 router in the facility. Dec 5 18:52:00: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down BGP Notification sent Dec 5 18:53:40: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 18:55:07: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 18:58:42: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:00:12: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 19:09:41: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:11:08: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 19:16:21: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:17:47: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 19:18:54: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:20:24: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down BGP Notification sent Dec 5 19:40:58: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:43:14: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down BGP Notification sent Dec 5 19:47:03: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:48:51: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down BGP Notification sent Dec 5 19:50:54: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:52:21: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 19:53:44: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:55:11: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down NSF peer closed the session Dec 5 19:55:57: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Up Dec 5 19:57:27: %BGP-5-ADJCHANGE: neighbor 2001:504:D::47 Down BGP Notification sent Peter Kranz www.UnwiredLtd.com Desk: 510-868-1614 x100 Mobile: 510-207-0000 pkranz(a)unwiredltd.com

1 0

Re: Novice sysadmins (was: Suggestions for a more privacy conscious email provider)
by Scott Weeks 06 Dec '17

06 Dec '17

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> Even the relatively good ones are bad. I have identified 60 and am on track to identify about 200 errors in the official ISC2 CISSP study guide. ----------------------------------------- One last one I promise... :-) I also have to maintain a Security+ cert, which is part of the CISSP. I absolutely despise the number of incorrect answers and misinformation that cert puts out. After I'm done taking that one everyone leaves me alone for the rest of the afternoon... >:-( I would not consider the Security+ a 'relatively good one'. Rather, it's one of the worst I have ever had to do! scott

1 0

Re: Novice sysadmins (was: Suggestions for a more privacy conscious email provider)
by Scott Weeks 06 Dec '17

06 Dec '17

--- list(a)satchell.net wrote: From: Stephen Satchell <list(a)satchell.net> Indeed, I'm not aware of any certification that applies to system administrators. Network administrators have certs that are well-recognized and accepted. Mail admins? Server admins? The certs that are out there border on jokes or disguised sale pitches. --------------------------------------- Have you seen neteng certs lately? I'm forced to maintain a lower level one to keep my job and it makes me angry every time I have to do it. The sales pitch is hidden in the words and the correct answer is almost always something that has to do with the proprietary item the vendor has. scott

2 1

Lanner Devices - NCA-5510
by Raymond Burkholder 05 Dec '17

05 Dec '17

Hello, A number of people have been suggesting Lanner boxes for routing. I have used FW-7543A and FW-7573A boxes with Debian with no issues. I am currently trying the NCA-5510 model with NCS2-IGM806B (XL710) and NCS2-IXM407A (I350) cards with a standard Debian Stretch installation. I was hoping that it would be as easy as installing the operating system, turning ports up, and getting a working network. It was like that with the other models. Not with this model. There seems to be a bunch of different BIOS combinations which give different (bad) results. And for the combinations I've tried, I can't seem to get the XL710 card to work properly. Maybe I should have gone with the 82599 card instead. In addition, the I210 based management port also isn't coming up properly, always some sort 'interface reset' error. Which, with some bios settings, I get on the I350 cards as well. If someone has a similar model and/or configuration, what sort of BIOS/Kernel settings have you used to get something operationally stable? Any particular Kernel versions work best? I tried 4.9.51, and 4.14.3. It seems to take about 48 hours to get turn arounds from Taiwan engineering, which I am currently trying to escalate from a sales office, but was hoping, in the meantime, someone else might have some experiences to share? I can provide console / kernel messages to show what I am encountering for those interested. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Akamai contact
by J. Oquendo 05 Dec '17

05 Dec '17

Can one of the Akamai (non salesy) guys ping me off list please. Security related. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 0A96 6318 EA49 4032 21C9 A7A8 81E9 3E95 414F 356E https://pgp.mit.edu/pks/lookup?op=get&search=0x81E93E95414F356E

2 1

Any from amazon cloud app.conceptboard.com
by Shoaib Farhan 05 Dec '17

05 Dec '17

Hi, Anyone from Amazon Cloud in this list. Need help for app.conceptboard.com. Our client complaining they are getting disconnected from this site. Traceroute/mtr showing path is keep changing. traceroute to app.conceptboard.com (52.17.144.46), 30 hops max, 60 byte packets 1 noc-ut-gw.telnet.net.bd (120.50.31.17) 0.513 ms 0.619 ms 0.677 ms 2 116.212.104.25 (116.212.104.25) 0.842 ms 0.840 ms 0.943 ms 3 DHANMONDI-RTR1-2-BANANI-RTR.TELNET.COM.BD (116.212.104.173) 1.157 ms 1.212 ms 1.274 ms 4 43.224.113.185 (43.224.113.185) 0.974 ms 0.975 ms 0.977 ms 5 43.228.208.17 (43.228.208.17) 1.353 ms 1.355 ms 1.327 ms 6 43.228.208.1 (43.228.208.1) 2.229 ms 1.327 ms 4.002 ms 7 125.17.155.45 (125.17.155.45) 40.688 ms 42.783 ms 40.885 ms 8 182.79.245.18 (182.79.245.18) 170.338 ms 182.79.198.129 (182.79.198.129) 172.306 ms 203.101.100.170 (203.101.100.170) 172.314 ms 9 ams1-br-tra-r2.amazon.com (80.249.210.217) 199.384 ms 199.389 ms 197.153 ms 10 54.239.114.48 (54.239.114.48) 220.252 ms 54.239.114.96 (54.239.114.96) 219.471 ms 54.239.114.36 (54.239.114.36) 226.921 ms 11 54.239.114.65 (54.239.114.65) 222.170 ms 54.239.114.79 (54.239.114.79) 218.172 ms 54.239.114.89 (54.239.114.89) 218.971 ms 12 54.239.41.117 (54.239.41.117) 216.664 ms 54.239.41.119 (54.239.41.119) 216.329 ms 54.239.43.16 (54.239.43.16) 216.342 ms 13 54.239.41.206 (54.239.41.206) 216.650 ms 54.239.44.142 (54.239.44.142) 216.647 ms 216.635 ms 14 * * 54.239.41.204 (54.239.41.204) 215.933 ms 15 52.93.6.148 (52.93.6.148) 237.179 ms 52.93.7.186 (52.93.7.186) 231.180 ms 52.93.6.160 (52.93.6.160) 218.251 ms 16 52.93.7.3 (52.93.7.3) 216.543 ms 52.93.7.31 (52.93.7.31) 212.299 ms 52.93.7.19 (52.93.7.19) 218.105 ms 17 52.93.36.34 (52.93.36.34) 216.943 ms 52.93.7.8 (52.93.7.8) 230.334 ms 52.93.7.10 (52.93.7.10) 235.409 ms 18 52.93.7.101 (52.93.7.101) 218.487 ms 52.93.7.97 (52.93.7.97) 218.505 ms 52.93.7.117 (52.93.7.117) 217.368 ms 19 * * 178.236.0.213 (178.236.0.213) 215.187 ms 20 * * * MT: HOST: farhan.telnet.net.bd Loss% Snt Last Avg Best Wrst StDev 1.|-- noc-ut-gw.telnet.net.bd 0.0% 500 0.5 0.5 0.2 54.8 2.5 2.|-- 116.212.104.25 0.0% 500 0.9 0.8 0.7 1.6 0.0 3.|-- DHANMONDI-RTR1-2-BANANI-R 1.2% 500 0.8 2.0 0.8 187.7 12.6 4.|-- 43.224.113.185 0.0% 500 1.1 3.8 0.9 84.4 10.9 5.|-- 43.228.208.17 0.0% 500 1.2 1.9 1.0 16.7 1.6 6.|-- 43.228.208.1 0.0% 500 4.5 2.3 1.0 95.5 5.7 7.|-- 125.17.155.45 0.0% 500 41.2 42.5 39.9 109.5 6.6 8.|-- 182.79.247.217 0.2% 500 173.8 170.4 169.3 216.0 3.6 9.|-- ams1-br-tra-r2.amazon.com 2.8% 500 201.9 201.6 192.8 222.7 3.3 10.|-- 54.239.114.84 2.2% 500 222.7 224.8 211.8 336.8 9.6 11.|-- 54.239.114.91 1.8% 500 219.0 219.6 208.8 293.0 7.5 12.|-- 54.239.41.119 1.2% 500 218.3 218.1 208.9 257.0 3.9 13.|-- 54.239.44.140 2.2% 500 219.5 219.8 211.6 265.5 3.5 14.|-- ??? 100.0 500 0.0 0.0 0.0 0.0 0.0 15.|-- 52.93.6.136 1.8% 500 222.2 234.4 212.1 382.2 14.0 16.|-- 52.93.7.25 2.6% 500 212.9 218.8 208.9 248.9 4.2 17.|-- 52.93.7.18 2.8% 500 235.3 230.9 214.0 266.2 12.2 18.|-- 52.93.7.115 1.6% 500 217.8 218.0 210.0 244.2 2.4 19.|-- ??? 100.0 500 0.0 0.0 0.0 0.0 0.0 Any help would be appreciated. -- Regards, Md. Shoaib Farhan <http://www.telnet.com.bd>

1 0

100G - Whitebox
by Mike Hammett 04 Dec '17

04 Dec '17

I first sent to an IX-specific mailing list, but as I have yet to see the message hit the list, I figured I would post it here as well. We've had multiple requests for 100G interfaces (instead of Nx10G) and no one seems to care about the 40G interfaces we have available. Looking at cost effective options brings us to whitebox switches. Obviously there's a wide range of hardware vendors and there are a few OSes available as well. Cumulus seems to be the market leader, while IPinFusion seems to be the most feature-rich. We're not doing any automation on the switches at this time, so it would still need decent manual configuration. It wouldn't need a Cisco-centric CLI as we're quite comfortable managing standard Linux-type config files. We're not going all-in on some overlay either given that we wouldn't be replacing our entire infrastructure, only supplementing it where we need 100G. I know that LINX has gone IPinfusion. What OS would be appropriate for our usage? I'm not finding many good comparisons of the OSes out there. I'm assuming any of them would work, but there may be gotchas that a "cheapest that meets requirements" doesn't quite unveil. Any particular hardware platforms to go towards or avoid? Broadcom Tomahawk seems to be quite popular with varying control planes. LINX went Edgecore, which was on my list given my experience with other Accton brands. Fiberstore has a switch where they actually publish the pricing vs. a bunch of mystery. Thoughts? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

10 12

Alternatives to ISE?
by Christopher J. Wolff 04 Dec '17

04 Dec '17

I've about reached my limit with the dumpster fire that is Cisco's Identity Service Engine. Are there any reliable alternatives that do endpoint classification, central web auth, and .1x auth? Thanks in advance, Christopher

7 7

BGP next-hop self benefits
by craig washington 04 Dec '17

04 Dec '17

Hello everyone, Question, what are the true benefits to using the next-hop self feature, doesn't matter what vendor. Most information I see is just to make sure you have reach-ability for external routes via IBGP, but what if all your IBGP knows the eBGP links? Is there a added benefit to using next hop self in this situation? Any feedback is much appreciated, either for the question specifically or whatever else you got 😊, L3VPN's or underlying technology that has to have that. Thanks

4 3